Stream Filter rules in graylog

problem description

there are two types of logs in a stream, one containing classNo fields and the other containing classNO fields (yes, the only difference is case, but I can"t change it yet! The contents of the two fields are actually the same, but the other fields of the two logs are not exactly the same.
for example: a log content is {"name": "a", "classNo": "aaa-111-001"}, B log content is {" name ":" b "," age ":" 12 "," classNO ":" bbb-111-002"}, C log content is {"name": "cc", "classNo": "cc-111-001"," marjor ":" english "}

the platform version of the problem and what methods you have tried

after adding a rule such as classNo regular match to the rules of stream, there is only a log with a classNo field in stream, and another kind of log is missing. Conversely, it is the same with using classNO as the Filter rule.

related codes

/ / Please paste the code text below (do not replace the code with pictures)

what result do you expect? What is the error message actually seen?

1. Is there anything wrong with my operation?
2. How should I use both Filter logs at the same time?

Thank you, bosses!

Mar.30,2021
Menu